Initial commit — Performance West telecom compliance platform

Includes: API (Express/TypeScript), Astro site, Python workers,
document generators, FCC compliance tools, Canada CRTC formation,
Ansible infrastructure, and deployment scripts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/document_gen/templates/calea_satellite_generator.py

@@ -0,0 +1,220 @@
+"""
+CALEA SSI Plan — Satellite (MSS / FSS) variant.
+
+Satellite carriers that provide telecommunications service (MSS) or
+facilitate it (certain FSS transport arrangements) are subject to CALEA.
+Intercept capability is generally provisioned at the ground segment —
+i.e., the earth station / NOC / IP gateway — where subscriber sessions
+terminate before hand-off to the PSTN or public Internet.  This variant
+documents the ground-segment intercept model, the Part 25 physical-
+security controls, and the delegation to terrestrial-network partners
+where applicable.
+"""
+from __future__ import annotations
+
+import logging
+from datetime import date
+from pathlib import Path
+from typing import Optional
+
+LOG = logging.getLogger("document_gen.calea_satellite")
+
+try:
+    from docx import Document
+    from docx.shared import Pt, Inches, RGBColor
+    from docx.enum.text import WD_ALIGN_PARAGRAPH
+except ImportError:
+    LOG.warning("python-docx not installed — CALEA Satellite unavailable")
+    Document = None  # type: ignore[assignment,misc]
+
+NAVY = RGBColor(0x1A, 0x27, 0x44) if Document else None
+
+VARIANT_ID = "satellite"
+VARIANT_LABEL = "Satellite (MSS / FSS)"
+
+
+def _heading(doc, text):
+    p = doc.add_paragraph()
+    p.paragraph_format.space_before = Pt(12); p.paragraph_format.space_after = Pt(4)
+    r = p.add_run(text); r.bold = True; r.font.size = Pt(13); r.font.color.rgb = NAVY
+
+
+def _body(doc, text, bold=False):
+    p = doc.add_paragraph(); p.paragraph_format.space_after = Pt(6)
+    r = p.add_run(text); r.font.size = Pt(11); r.bold = bold
+
+
+def _bullets(doc, items):
+    for it in items:
+        p = doc.add_paragraph(style="List Bullet")
+        p.paragraph_format.left_indent = Inches(0.25)
+        p.paragraph_format.space_after = Pt(3)
+        p.clear(); r = p.add_run(it); r.font.size = Pt(11)
+
+
+def generate_calea_satellite(
+    output_path: str,
+    entity_name: str,
+    frn: str = "",
+    law_enforcement_contact: Optional[dict] = None,
+    cpni_protection_officer: Optional[dict] = None,
+    network_infrastructure_summary: str = "",
+    interception_support_method: str = "",
+    reporting_year: int = 0,
+    signatory_name: str = "",
+    signatory_title: str = "Chief Executive Officer",
+    effective_date: str = "",
+    next_review_date: str = "",
+    reviewer_name: str = "Justin Hannah",
+    reviewer_company: str = "Performance West Inc.",
+    **_: dict,
+) -> Optional[str]:
+    if Document is None:
+        LOG.error("python-docx not installed")
+        return None
+
+    le = law_enforcement_contact or {}
+    cpni = cpni_protection_officer or {}
+    today = date.today()
+    effective = effective_date or today.strftime("%m/%d/%Y")
+    next_review = next_review_date or today.replace(year=today.year + 1).strftime("%m/%d/%Y")
+
+    doc = Document()
+    for s in doc.sections:
+        s.top_margin = Inches(1); s.bottom_margin = Inches(1)
+        s.left_margin = Inches(1.25); s.right_margin = Inches(1.25)
+
+    title = doc.add_paragraph(); title.alignment = WD_ALIGN_PARAGRAPH.CENTER
+    tr = title.add_run("System Security and Integrity (SSI) Plan")
+    tr.font.size = Pt(15); tr.bold = True; tr.font.color.rgb = NAVY
+    sub = doc.add_paragraph(); sub.alignment = WD_ALIGN_PARAGRAPH.CENTER
+    sr = sub.add_run(entity_name); sr.font.size = Pt(13); sr.bold = True
+    vsub = doc.add_paragraph(); vsub.alignment = WD_ALIGN_PARAGRAPH.CENTER
+    vr = vsub.add_run(f"Variant: {VARIANT_LABEL}")
+    vr.font.size = Pt(11); vr.italic = True
+    cite = doc.add_paragraph(); cite.alignment = WD_ALIGN_PARAGRAPH.CENTER
+    cr = cite.add_run(
+        "Pursuant to 47 U.S.C. \u00a7 229, 47 CFR \u00a7 1.20003, and "
+        "47 CFR Part 25"
+    )
+    cr.font.size = Pt(10); cr.italic = True
+    cite.paragraph_format.space_after = Pt(18)
+
+    _heading(doc, "1. Purpose")
+    _body(doc, (
+        f"This SSI Plan governs {entity_name}'s compliance with CALEA and "
+        f"47 CFR \u00a7 1.20003 as applied to {entity_name}'s operations "
+        f"as a provider of Mobile Satellite Service and/or Fixed Satellite "
+        f"Service telecommunications."
+    ))
+
+    _heading(doc, "2. Scope and Applicability")
+    _body(doc, (
+        f"{entity_name} operates (or leases capacity from) a space segment "
+        f"and ground-segment infrastructure including earth stations, "
+        f"gateway facilities, and a network operations center (NOC). "
+        f"Subscriber sessions originate at user terminals, traverse the "
+        f"satellite, and terminate at ground-segment gateways before "
+        f"hand-off to terrestrial networks. CALEA obligations apply to "
+        f"the telecommunications-service portions of this traffic."
+    ))
+
+    _heading(doc, "3. Designated Law Enforcement Contact (24-hour)")
+    _body(doc, (
+        f"Per 47 CFR \u00a7 1.20003(a)(1), {entity_name} designates the "
+        f"following senior officer as 24-hour contact for law enforcement "
+        f"service of process."
+    ))
+    _bullets(doc, [
+        f"Name: {le.get('name') or '[TO BE POPULATED]'}",
+        f"Title: {le.get('title') or ''}",
+        f"Phone (24-hour): {le.get('phone') or ''}",
+        f"Email (24-hour): {le.get('email_24h') or ''}",
+        f"Backup contact: {le.get('backup_name') or '[TO BE POPULATED]'}",
+    ])
+
+    _heading(doc, "4. Network Architecture and Interception Capability")
+    _body(doc, network_infrastructure_summary or (
+        f"{entity_name}'s ground segment comprises earth-station antennas, "
+        "baseband modems, gateway routing / softswitch elements, and NOC "
+        "monitoring. Physical access to these facilities is controlled "
+        "under the Part 25 earth-station license conditions."
+    ))
+    _body(doc, interception_support_method or (
+        f"Lawful intercept is provisioned at the ground segment where "
+        "subscriber sessions are decrypted / de-encapsulated for hand-off. "
+        "Content and call-identifying information are delivered to the "
+        "requesting law-enforcement agency using the CALEA safe-harbor "
+        "interfaces (ATIS J-STD-025 for voice / TIA TR-45 equivalents for "
+        "data) or a mutually agreed alternative acceptable under 47 CFR "
+        "Part 1 Subpart Z.  Where {entity_name} hands off traffic to a "
+        "terrestrial partner for switching or transport, the partner "
+        "supports intercept under its own CALEA plan and the plans are "
+        "coordinated."
+    ).replace("{entity_name}", entity_name))
+
+    _heading(doc, "5. CPNI Safeguards")
+    _body(doc, (
+        f"{entity_name} maintains separate CPNI procedures under 47 CFR "
+        f"\u00a7\u00a7 64.2001\u201364.2011. Customer activation records, "
+        f"beam / transponder assignments, and NOC operator logs are "
+        f"within the CPNI Protection Officer's oversight. The CPNI "
+        f"Protection Officer is:"
+    ))
+    _bullets(doc, [
+        f"Name: {cpni.get('name') or '[TO BE POPULATED]'}",
+        f"Title: {cpni.get('title') or 'CPNI Protection Officer'}",
+    ])
+
+    _heading(doc, "6. Personnel Vetting and Training")
+    _bullets(doc, [
+        "Annual CALEA + CPNI training for NOC operators and LI-provisioning "
+        "personnel.",
+        "Background checks performed prior to granting access to ground-"
+        "segment provisioning systems.",
+        "Physical access to earth-station / NOC facilities controlled per "
+        "Part 25 license conditions.",
+        "LI provisioning attributed to named authenticated users.",
+    ])
+
+    _heading(doc, "7. Supervisory Review")
+    _body(doc, (
+        f"The {le.get('title') or 'Designated Senior Officer'} reviews LI "
+        f"activity and NOC operator access logs at least quarterly."
+    ))
+
+    _heading(doc, "8. Records Retention")
+    _body(doc, (
+        "LI provisioning and service-of-process records retained ten (10) "
+        "years per 47 CFR \u00a7 1.20003(b); CPNI access logs retained at "
+        "least two (2) years per 47 CFR \u00a7 64.2009."
+    ))
+
+    _heading(doc, "9. Annual Review")
+    _body(doc, (
+        f"Reviewed at least annually and upon material change to the "
+        f"ground segment, earth-station license, or terrestrial hand-off "
+        f"arrangement. Next scheduled review: {next_review}."
+    ))
+
+    _heading(doc, "10. Certification")
+    _body(doc, (
+        f"I, {signatory_name or '[Authorized Officer]'}, as "
+        f"{signatory_title} of {entity_name}, certify that I have "
+        f"reviewed this SSI Plan and that {entity_name} complies with 47 "
+        f"U.S.C. \u00a7 229 and 47 CFR \u00a7 1.20003."
+    ))
+    _body(doc, "")
+    doc.add_paragraph("_" * 45)
+    _body(doc, signatory_name or "[Authorized Officer]", bold=True)
+    _body(doc, f"{signatory_title}, {entity_name}")
+    _body(doc, f"Effective Date: {effective}")
+    if frn: _body(doc, f"FRN: {frn}")
+    _body(doc, f"Reviewed By: {reviewer_name}, {reviewer_company}")
+    _body(doc, f"Next Review Date: {next_review}")
+
+    out = Path(output_path)
+    out.parent.mkdir(parents=True, exist_ok=True)
+    doc.save(str(out))
+    LOG.info("CALEA Satellite SSI plan generated: %s", out)
+    return str(out)